Flash: wild pointer in button handling

[GoogleCodeExporter]

The attached sample, 
signal_sigsegv_7ffff60a1429_9554_f4dc661554237404dfe394d4c6c3e674.swf, crashes 
in this manner on Linux x64:

=> 0x00007f693158481f:  movzbl (%rcx),%r11d
rcx            0x3102ffffecfd   53888954658045

The base sample from which this fuzz case was generated is also attached. We 
believe this may be related to button handling.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by cev...@google.com on 20 May 2015 at 11:18

Attachments:

• signal_sigsegv_7ffff60a1429_9554_f4dc661554237404dfe394d4c6c3e674.swf
• f4dc661554237404dfe394d4c6c3e674.swf

[GoogleCodeExporter]

PSIRT-3733

Original comment by cev...@google.com on 26 May 2015 at 10:17

• Added labels: Id-3733

[GoogleCodeExporter]

Original comment by natashe...@google.com on 11 Aug 2015 at 3:36

• Changed state: Fixed
• Added labels: CVE-2015-5547

[GoogleCodeExporter]

Fixed in https://helpx.adobe.com/security/products/flash-player/apsb15-19.html

Original comment by natashe...@google.com on 18 Aug 2015 at 7:34

[GoogleCodeExporter]

Original comment by natashe...@google.com on 18 Aug 2015 at 7:34

• Removed labels: Restrict-View-Commit